Application of Cluster-Based Local Outlier Factor

Algorithm in Anti-Money Laundering

AML Issues

• Anti-money laundering (AML) in financial industry is based on the analysis and processing of Suspicious Activity Reports (SARs) filed by financial institutions (FIs), but the very large number of SARs usually makes financial intelligence units’ (FIUs’) analysis a waste of time and resources simply because only a few transactions are really suspicious in a given amount [1], so financial AML is far from a real-time, dynamic, and self-adaptable recognition of suspicious money laundering transactional behavioral patterns (SMLTBPs).

Literature Survey

• Literature review finds that artificial intelligence [2], support vector machine (SVM) [3], outlier detection [4], and break-point analysis (BPA) [5] are used to improve FIs’ ability in processing suspicious data, various approaches to novelty detection on time series data are examined in [6], outlier detection methodologies are surveyed by [7], and a data mining-based framework for AML research is proposed in [8] after a comprehensive comment is made on relative studies.

Proposed Algorithm

• The CBLOF algorithm combines distance-based unsupervised clustering and local outlier [12] detection, and clustering is for the purpose of pre-processing data for the consequent anomaly identification.

• As far as the nature of money laundering (ML) is concerned, the chosen clustering algorithm should be able to generate the number of clusters automatically (with no need for pre-establishment) and all the clusters are to be ranked according to the number of the components in each. Thus we propose the following procedures:

Clustering Step

Clustering Step (Cont’d)

Outlier Detection

• An outlier is a point that deviates so much from surrounding “normal” points as to arouse suspicion that it was generated by a different mechanism.

• After clustering, all the samples have been categorized into mutually exclusive clusters ranked as per the number of their components.

• As most transactions in an account are usually normal or legal, the clusters generated from above are divided into Large Category (LC) and Small Category (SC) in this paper, with the former being supposed to represent normal transactional behavioral patterns free of ML suspicion and the latter, on the contrary, for anomalous patterns worth notice.

Outlier Detection (Cont’d)

Outlier Detection (Cont’d)

• Furthermore, the points in SC are all outliers when compared with those in LC [13, 14].

• But for AML research, seasonal industries and some special industries must be exempted because abnormal phenomena in a particular period can never be treated as ML red flags.

• So the paper will study n number of data points with top local outlier factor (LOF) values because they are more of ML suspicion.

• Also, this can effectively improve AML pertinence.

Local Outlier Factor

• In the light of the local outlier definition in [12], LOF can be employed to measure the deviant degree of SC points from LC, i.e., how far the transactional behavioral patterns represented by the points in SC deviate from the normal or legitimate patterns, where LOF value is determined by the number of the components in the clusters sample data belong to and the distance from sample data to the nearest LC.

Local Outlier Factor (Cont’d)

Metrics

• We are more interested in the transactional behavioral attributes like amount and frequency than in the account owner’s subjective characters, thus transaction amount, transaction amount deviation coefficiency, and transaction frequency (i.e., withdrawal frequency and deposit frequency) are chosen to be research variables with the following definitions:

Metric 1: Transaction Amount

Metric 2: TA Deviation Coefficiency

Metric 3: Withdrawal/Deposit Frequency

• Definition 3: Withdrawal/deposit frequency is the ratio of the number of withdrawal/deposit transfers to the aggregated frequency of transactions.

• Analyzing withdrawal frequency and deposit frequency can identify two novel capital flows within a short time frame:– one is centralized capital in-transfers followed by

decentralized capital out-transfers,– and the other is decentralized capital in-transfers

followed by centralized out-transfers.

Prepare Data Samples

• Just like the authors of [6], we are most interested in data patterns that deviate from the normal operational data.

• So historical transaction records are to be transformed into several segments or subsequences of neighboring single transactions, with one segment (subsequence) representing one behavioral pattern, and the transactional data embedded in SMLTBPs are just the suspicious objects we hope to find out.

• For each feature as above mentioned, calculate its feature value for each segment and take the feature vectors composed of feature values as research samples.

Design of Experiments

• In this research, we have collected from 108 accounts of one commercial bank 34,303 authentic transactional data from January 1 through October 30, 2006 out of which the account data of 25 firms in 4 industries sharing similar turnover scale and transactional frequency are taken as experimental samples.

• Meanwhile, twenty segments of synthetic data are generated by the mechanism in Figure 1 [15, 16] to test the applicability of the algorithm in detecting abnormal objects.

• Each segment of artificial simulation data is employed twice.

Design of Experiments (Cont’d)

• As per the Regulations for Financial Institutions to File Currency Transaction Reports and Suspicious Transaction Reports of the People’s Bank of China, ten days is accepted as the standard to segment transactional data.

• After pre-processing the experimental data, segmenting the subsequences, and extracting the feature values, we obtain 696 experimental samples of 25 accounts, of which only 40 synthetic data samples are listed in Table 1 due to the limit of the paper.

Data Set

Experiment Results

• Do experiment with the CBLOF algorithm on the sample set.

• As global outlier detection cannot mine all the outliers [12], give LOF value to each sample, and then identify n number of samples with the highest LOF values for further investigation and final reporting.

Experiment Results (Cont’d)

• Let clustering threshold ε ＝ 0.15 and categorization parameters α ＝ 75 ％ and β ＝ 4, we will first of all standardize the dimensions of data samples, and then program with C++ language, cluster, categorize LC and SC, and compute LOF values of transaction segments.

• Once more only a part of the experimental results are shown in Table 2 due to the limit of the paper, where only the five samples with top LOF values are listed for each account.

• They are the five transactions with the highest degree of suspiciousness, as well.

Experiment Results (Cont’d)

Conclusions• Making a good use of the advantages of both distance-based

unsupervised clustering and local outlier detecting, the CBLOF algorithm can effectively identify the synthetic data suspicious of ML transactions with a high processing speed and a satisfactory accuracy.

• Needing neither prior samples to serve as training data nor the number of clusters to be designated in advance can solve the problem that AML research is always in short of case data.

• In particular, the algorithm is self-adaptable to the evolution of ML methods and can recognize SMLTBPs that haven’t been detected before, which is quite beneficial in saving limited investigation resources and preventing FIs from filing defensive SARs [17].

Conclusions (Cont’d)

• However, only a few transactional behavioral features of amount and frequency are studied in this paper, so relative subjective characters of the account owner remains open to our future research.